From 9f6fa9b1e322fe3f6b958f300673cf28f6eb38da Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:31:52 +0000 Subject: [PATCH 1/3] chore(ci): one-off actions.lock regeneration run (removed before review) Repurposes the leftover one-off workflow from #441 to regenerate echidna's own lock in CI with the estate repair chain, since this session cannot reach the GitHub API. Removed again in a later commit on this branch. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015jzCHZx4Rt65NDaGLDrjLp --- .github/workflows/zz-one-off-lock-regen.yml | 120 ++++++++++++++------ 1 file changed, 84 insertions(+), 36 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index a66359d9..d523891d 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -1,55 +1,103 @@ # SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, scratch branch only, deleted after use. Regenerates panic-attack's fix branch's +# ONE-OFF, removed again before the PR leaves draft. Regenerates echidna's own # actions.lock with the estate repair order (regen_lock in -# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own -# check against the result, and prints the lock base64-encoded. It has no -# `uses:` steps, so it needs no lock entry to start. It writes nothing back: -# the lock reaches the repository in a reviewed PR. +# standards/scripts/regen-dependabot-locks.sh: gh actions-lock, relock-sha-keys, +# complete-job-refs, close-lock, prune-stale), on a tree where this file is +# already deleted, then checks the result with close-lock (dangling count), +# `gh actions-lock --verify`, check-lock-sync, the governance gate, and a +# Hypatia scan at aa34a4cc. It has no `uses:` steps, so it needs no lock entry +# to start. It writes nothing back: the lock is printed and reaches the +# repository in a reviewed commit. name: one-off actions.lock regeneration on: push: - branches: [claude/new-session-th4e9w-lockregen] + branches: [claude/stoic-brown-26h7xi] permissions: contents: read jobs: regen: - runs-on: ubuntu-latest - timeout-minutes: 20 + runs-on: ubuntu-24.04 + timeout-minutes: 40 env: GH_TOKEN: ${{ github.token }} - REPO: hyperpolymath/panic-attack - STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 + BRANCH: claude/stoic-brown-26h7xi + STANDARDS_SHA: 3c00687a5bbd0d881d351db8502417b5d0a8b0b0 + STANDARDS_GATE_PINNED_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 + HYPATIA_SHA: aa34a4cc6ba39d873710ff39763fdb9cde715f9d steps: - - name: Regenerate the repair branch's actions.lock and check it with the gate + - name: Regenerate actions.lock and verify it run: | set -uo pipefail - git clone --quiet --branch claude/new-session-th4e9w https://github.com/hyperpolymath/panic-attack.git pb - git -C pb log --oneline -1 + cd "$RUNNER_TEMP" + git clone --quiet --branch "$BRANCH" https://github.com/hyperpolymath/echidna.git ec + git -C ec log --oneline -1 + cp ec/.github/workflows/actions.lock lock.before + # The tree the PR lands: this one-off file deleted. + git -C ec -c user.name=regen -c user.email=regen@localhost rm --quiet .github/workflows/zz-one-off-lock-regen.yml + git -C ec -c user.name=regen -c user.email=regen@localhost commit --quiet -m "drop one-off" git clone --quiet https://github.com/hyperpolymath/standards.git std - git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA" - git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA" + git -C std worktree add --quiet --detach ../std-new "$STANDARDS_SHA" + git -C std worktree add --quiet --detach ../std-pin "$STANDARDS_GATE_PINNED_SHA" sudo apt-get install -y -qq gawk >/dev/null gh extension install github/gh-actions-lock --pin v0.2.0 gh actions-lock --version - # Full estate regen (gh actions-lock first, which also migrates the - # format to v0.0.3, then the repair chain). - export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" - # Start from no lock: main's pins v1 at a commit the tag no longer - # names, which gh actions-lock rejects as a conflicting target. - rm -f pb/.github/workflows/actions.lock - (cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; }) - test -f pb/.github/workflows/actions.lock && echo SEEDED - source std-regen/scripts/regen-dependabot-locks.sh - outcome="$(regen_lock "$PWD/pb" || true)" + export GH_BIN=gh REGEN_TOOLS="$PWD/std-new/scripts" + source std-new/scripts/regen-dependabot-locks.sh + outcome="$(regen_lock "$PWD/ec" || true)" echo "OUTCOME=$outcome" - (cd pb && { bash ../std-regen/scripts/check-lock-sync.sh .github/workflows && echo "SYNC RC=0" || echo "SYNC RC=$?"; }) - head -5 pb/.github/workflows/actions.lock - git -C pb status --porcelain - echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)" - (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ - bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" - echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" - echo "LOCK-BEGIN" - cat pb/.github/workflows/actions.lock - echo "LOCK-END" + git -C ec status --porcelain + echo "== close-lock re-run (expect dangling refs: 0, exit 0)" + (cd ec && GH_BIN=gh bash ../std-new/scripts/close-lock.sh; echo "CLOSE_RC=$?") + git -C ec diff --quiet -- .github/workflows/actions.lock && echo "close-lock re-run: no further change" || echo "close-lock re-run: CHANGED the lock" + echo "== independent dangling-edge count" + L=ec/.github/workflows/actions.lock + awk '/^dependencies:/{f=1;next} f&&match($0,/^ '\''[^'\'']+'\'':$/){k=$0;sub(/^ '\''/,"",k);sub(/'\'':$/,"",k);print k}' "$L" | LC_ALL=C sort -u > keys.txt + { awk '/^workflows:/{f=1;next} f&&/^[a-z_]+:/{f=0} f&&match($0,/^ - '\''[^'\'']+'\''/){k=$0;sub(/^ - '\''/,"",k);sub(/'\''.*$/,"",k);print k}' "$L" + awk '/^dependencies:/{f=1} f&&match($0,/^ - '\''[^'\'']+'\''/){k=$0;sub(/^ - '\''/,"",k);sub(/'\''.*$/,"",k);print k}' "$L"; } | LC_ALL=C sort -u > edges.txt + echo "DANGLING=$(LC_ALL=C comm -23 edges.txt keys.txt | grep -c . || true)" + LC_ALL=C comm -23 edges.txt keys.txt + echo "== gh actions-lock --verify" + (cd ec && { gh actions-lock --verify; echo "VERIFY_RC=$?"; }) + git -C ec status --porcelain + git -C ec checkout --quiet -- . ':(exclude).github/workflows/actions.lock' + echo "== update-actions-lock.sh --verify-local" + (cd ec && { GH_BIN=gh bash ../std-new/scripts/update-actions-lock.sh --verify-local; echo "VERIFY_LOCAL_RC=$?"; }) + echo "== check-lock-sync.sh" + (cd ec && { bash ../std-new/scripts/check-lock-sync.sh .github/workflows; echo "SYNC_RC=$?"; }) + for g in std-pin std-new; do + echo "== governance lock gate at $g" + (cd ec && ACTIONS_LOCK_VERIFIER="$PWD/../$g/scripts/update-actions-lock.sh" \ + bash "../$g/scripts/check-actions-lock-gate.sh" .github/workflows; echo "GATE_RC[$g]=$?") + done + git -C ec status --porcelain + echo "== diff against the branch's lock" + diff -u lock.before "$L" + echo "LOCK-SHA256 $(sha256sum < "$L" | cut -d' ' -f1)" + echo "LOCK-B64 $(base64 -w0 < "$L")" + cp "$L" lock.after + + - name: Hypatia scan at aa34a4cc, before and after + run: | + set -euo pipefail + cd "$RUNNER_TEMP" + # Elixir 1.19.4 / OTP 28.3 from builds.hex.pm (what erlef/setup-beam + # installs), so this job needs no `uses:` step. + mkdir -p otp elixir + curl -fsSL https://builds.hex.pm/builds/otp/ubuntu-24.04/OTP-28.3.tar.gz | tar xz -C otp --strip-components=1 + (cd otp && ./Install -minimal "$PWD" >/dev/null) + curl -fsSL -o elixir.zip https://builds.hex.pm/builds/elixir/v1.19.4-otp-28.zip + unzip -q elixir.zip -d elixir + export PATH="$PWD/otp/bin:$PWD/elixir/bin:$PATH" + elixir --version + mix local.hex --force >/dev/null && mix local.rebar --force >/dev/null + git init -q hy && git -C hy remote add origin https://github.com/hyperpolymath/hypatia.git + git -C hy fetch -q --depth 1 origin "$HYPATIA_SHA" && git -C hy checkout -q --detach FETCH_HEAD + git -C hy rev-parse HEAD + (cd hy && mix deps.get >/dev/null && mix escript.build >/dev/null) + for which in before after; do + cp "lock.$which" ec/.github/workflows/actions.lock + (cd ec && HYPATIA_FORMAT=json "$RUNNER_TEMP/hy/hypatia-cli.sh" scan . > "$RUNNER_TEMP/findings.$which.json" || true) + jq -e 'type == "array"' "findings.$which.json" >/dev/null || { echo "scan $which did not produce a JSON array"; head -c 2000 "findings.$which.json"; exit 1; } + echo "== $which: $(jq length "findings.$which.json") findings; invalid_actions_lock: $(grep -c invalid_actions_lock "findings.$which.json" || true) matching lines" + jq -c '.[] | select(tostring | test("invalid_actions_lock|workflow_dependencies_missing"))' "findings.$which.json" | head -20 + done From db944d4ceb14fe1f1bab3c7aa433d745ae886583 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:39:12 +0000 Subject: [PATCH 2/3] chore(ci): measure lock regen across caller-pin variants (one-off) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015jzCHZx4Rt65NDaGLDrjLp --- .github/workflows/zz-one-off-lock-regen.yml | 83 ++++++++++++++------- 1 file changed, 54 insertions(+), 29 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index d523891d..5a0e311f 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -5,9 +5,13 @@ # complete-job-refs, close-lock, prune-stale), on a tree where this file is # already deleted, then checks the result with close-lock (dangling count), # `gh actions-lock --verify`, check-lock-sync, the governance gate, and a -# Hypatia scan at aa34a4cc. It has no `uses:` steps, so it needs no lock entry -# to start. It writes nothing back: the lock is printed and reaches the -# repository in a reviewed commit. +# Hypatia scan at aa34a4cc. Three variants of the caller pins are measured: +# v0 pins as on main +# v1 panic-attack scan-and-report.yml -> panic-attack main (8955f615) +# v2 v1 + every hyperpolymath/standards reusable -> 3c00687a (standards#1315) +# It has no `uses:` steps, so it needs no lock entry to start. It writes +# nothing back: the lock is printed and reaches the repository in a reviewed +# commit. name: one-off actions.lock regeneration on: push: @@ -18,65 +22,86 @@ jobs: regen: runs-on: ubuntu-24.04 timeout-minutes: 40 + strategy: + fail-fast: false + matrix: + variant: [v0, v1, v2] env: GH_TOKEN: ${{ github.token }} + VARIANT: ${{ matrix.variant }} BRANCH: claude/stoic-brown-26h7xi STANDARDS_SHA: 3c00687a5bbd0d881d351db8502417b5d0a8b0b0 - STANDARDS_GATE_PINNED_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 + STANDARDS_OLD_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 + PANIC_OLD_SHA: b689a74d2762a1c19839ae3fbd59b7fe5ef920ea + PANIC_NEW_SHA: 8955f615f769204e42340e08bdea2de9d72e81cd HYPATIA_SHA: aa34a4cc6ba39d873710ff39763fdb9cde715f9d steps: - name: Regenerate actions.lock and verify it run: | - set -uo pipefail + set +e -uo pipefail cd "$RUNNER_TEMP" git clone --quiet --branch "$BRANCH" https://github.com/hyperpolymath/echidna.git ec git -C ec log --oneline -1 - cp ec/.github/workflows/actions.lock lock.before - # The tree the PR lands: this one-off file deleted. - git -C ec -c user.name=regen -c user.email=regen@localhost rm --quiet .github/workflows/zz-one-off-lock-regen.yml - git -C ec -c user.name=regen -c user.email=regen@localhost commit --quiet -m "drop one-off" + cp ec/.github/workflows/actions.lock lock.main + # The tree the PR lands: this one-off file deleted, pins per variant. + git -C ec rm --quiet .github/workflows/zz-one-off-lock-regen.yml + if [ "$VARIANT" != v0 ]; then + sed -i "s/$PANIC_OLD_SHA/$PANIC_NEW_SHA/" ec/.github/workflows/security-scan.yml + fi + if [ "$VARIANT" = v2 ]; then + grep -l "hyperpolymath/standards/.github/workflows/.*@$STANDARDS_OLD_SHA" ec/.github/workflows/*.yml \ + | xargs sed -i "s#\(hyperpolymath/standards/.github/workflows/[^@]*\)@$STANDARDS_OLD_SHA#\1@$STANDARDS_SHA#" + fi + git -C ec add -A + git -C ec diff --cached --stat + git -C ec diff --cached -- . ':(exclude).github/workflows/zz-one-off-lock-regen.yml' + git -C ec -c user.name=regen -c user.email=regen@localhost commit --quiet -m "variant $VARIANT" git clone --quiet https://github.com/hyperpolymath/standards.git std git -C std worktree add --quiet --detach ../std-new "$STANDARDS_SHA" - git -C std worktree add --quiet --detach ../std-pin "$STANDARDS_GATE_PINNED_SHA" + git -C std worktree add --quiet --detach ../std-old "$STANDARDS_OLD_SHA" sudo apt-get install -y -qq gawk >/dev/null gh extension install github/gh-actions-lock --pin v0.2.0 gh actions-lock --version export GH_BIN=gh REGEN_TOOLS="$PWD/std-new/scripts" source std-new/scripts/regen-dependabot-locks.sh - outcome="$(regen_lock "$PWD/ec" || true)" - echo "OUTCOME=$outcome" + set +e + outcome="$(regen_lock "$PWD/ec")" + echo "OUTCOME[$VARIANT]=$outcome" git -C ec status --porcelain echo "== close-lock re-run (expect dangling refs: 0, exit 0)" - (cd ec && GH_BIN=gh bash ../std-new/scripts/close-lock.sh; echo "CLOSE_RC=$?") - git -C ec diff --quiet -- .github/workflows/actions.lock && echo "close-lock re-run: no further change" || echo "close-lock re-run: CHANGED the lock" + (cd ec && GH_BIN=gh bash ../std-new/scripts/close-lock.sh; echo "CLOSE_RC[$VARIANT]=$?") + git -C ec diff --quiet -- .github/workflows/actions.lock && echo "lock unchanged vs variant commit" || echo "lock differs from the variant commit (expected: regenerated)" echo "== independent dangling-edge count" L=ec/.github/workflows/actions.lock awk '/^dependencies:/{f=1;next} f&&match($0,/^ '\''[^'\'']+'\'':$/){k=$0;sub(/^ '\''/,"",k);sub(/'\'':$/,"",k);print k}' "$L" | LC_ALL=C sort -u > keys.txt { awk '/^workflows:/{f=1;next} f&&/^[a-z_]+:/{f=0} f&&match($0,/^ - '\''[^'\'']+'\''/){k=$0;sub(/^ - '\''/,"",k);sub(/'\''.*$/,"",k);print k}' "$L" awk '/^dependencies:/{f=1} f&&match($0,/^ - '\''[^'\'']+'\''/){k=$0;sub(/^ - '\''/,"",k);sub(/'\''.*$/,"",k);print k}' "$L"; } | LC_ALL=C sort -u > edges.txt - echo "DANGLING=$(LC_ALL=C comm -23 edges.txt keys.txt | grep -c . || true)" + echo "DANGLING[$VARIANT]=$(LC_ALL=C comm -23 edges.txt keys.txt | grep -c .)" LC_ALL=C comm -23 edges.txt keys.txt echo "== gh actions-lock --verify" - (cd ec && { gh actions-lock --verify; echo "VERIFY_RC=$?"; }) + (cd ec && gh actions-lock --verify; echo "VERIFY_RC[$VARIANT]=$?") git -C ec status --porcelain git -C ec checkout --quiet -- . ':(exclude).github/workflows/actions.lock' echo "== update-actions-lock.sh --verify-local" - (cd ec && { GH_BIN=gh bash ../std-new/scripts/update-actions-lock.sh --verify-local; echo "VERIFY_LOCAL_RC=$?"; }) + (cd ec && GH_BIN=gh bash ../std-new/scripts/update-actions-lock.sh --verify-local; echo "VERIFY_LOCAL_RC[$VARIANT]=$?") echo "== check-lock-sync.sh" - (cd ec && { bash ../std-new/scripts/check-lock-sync.sh .github/workflows; echo "SYNC_RC=$?"; }) - for g in std-pin std-new; do + (cd ec && bash ../std-new/scripts/check-lock-sync.sh .github/workflows; echo "SYNC_RC[$VARIANT]=$?") + for g in std-old std-new; do echo "== governance lock gate at $g" (cd ec && ACTIONS_LOCK_VERIFIER="$PWD/../$g/scripts/update-actions-lock.sh" \ - bash "../$g/scripts/check-actions-lock-gate.sh" .github/workflows; echo "GATE_RC[$g]=$?") + bash "../$g/scripts/check-actions-lock-gate.sh" .github/workflows; echo "GATE_RC[$VARIANT/$g]=$?") done + git -C ec checkout --quiet -- . ':(exclude).github/workflows/actions.lock' git -C ec status --porcelain - echo "== diff against the branch's lock" - diff -u lock.before "$L" - echo "LOCK-SHA256 $(sha256sum < "$L" | cut -d' ' -f1)" - echo "LOCK-B64 $(base64 -w0 < "$L")" - cp "$L" lock.after + echo "== diff against main's lock" + diff -u lock.main "$L" + echo "LOCK-SHA256[$VARIANT] $(sha256sum < "$L" | cut -d' ' -f1)" + echo "LOCK-B64[$VARIANT] $(base64 -w0 < "$L")" + cp "$L" lock.regen + exit 0 - - name: Hypatia scan at aa34a4cc, before and after + - name: Hypatia scan at aa34a4cc, main's lock and the regenerated one + if: always() run: | set -euo pipefail cd "$RUNNER_TEMP" @@ -94,10 +119,10 @@ jobs: git -C hy fetch -q --depth 1 origin "$HYPATIA_SHA" && git -C hy checkout -q --detach FETCH_HEAD git -C hy rev-parse HEAD (cd hy && mix deps.get >/dev/null && mix escript.build >/dev/null) - for which in before after; do + for which in main regen; do cp "lock.$which" ec/.github/workflows/actions.lock (cd ec && HYPATIA_FORMAT=json "$RUNNER_TEMP/hy/hypatia-cli.sh" scan . > "$RUNNER_TEMP/findings.$which.json" || true) jq -e 'type == "array"' "findings.$which.json" >/dev/null || { echo "scan $which did not produce a JSON array"; head -c 2000 "findings.$which.json"; exit 1; } - echo "== $which: $(jq length "findings.$which.json") findings; invalid_actions_lock: $(grep -c invalid_actions_lock "findings.$which.json" || true) matching lines" - jq -c '.[] | select(tostring | test("invalid_actions_lock|workflow_dependencies_missing"))' "findings.$which.json" | head -20 + echo "== $VARIANT/$which lock: $(jq length "findings.$which.json") findings; invalid_actions_lock entries: $(jq '[.[] | select(tostring | test("invalid_actions_lock"))] | length' "findings.$which.json")" + jq -c '.[] | select(tostring | test("invalid_actions_lock|workflow_dependencies_missing"))' "findings.$which.json" | cut -c1-1500 done From fe04b5df93d14dafcc5395571128009d686e9ab6 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:51:09 +0000 Subject: [PATCH 3/3] fix(ci): close actions.lock by moving stale reusable pins upstream actions.lock v0.0.3 named two job-level reusable refs under `workflows:` with no top-level record (slsa-github-generator@f7dd8c54 and panic-attack@b689a74). Hypatia at aa34a4cc reports that as invalid_actions_lock in workflow_audit and workflow_hardening. The estate repair chain (gh actions-lock, relock-sha-keys, complete-job-refs, close-lock, prune-stale; standards 3c00687a) could not close the lock with the old pins. standards@75bd5994 (mirror-reusable.yml) and panic-attack@b689a74 pin dtolnay/rust-toolchain at e2a55d2 and 02cb101e. dtolnay moved its v1 tag, and no tag names either commit any more, so close-lock refuses to write their leaf records. Upstream main of both repos pins 683b588, the current v1, so the callers move there: - security-scan.yml: panic-attack scan-and-report.yml -> 8955f615 (one line changes in the called file: the dtolnay pin) - governance, hypatia-scan, mirror, scorecard, secret-scanner and spark-theatre-gate: standards reusables -> 3c00687a (standards#1315, hypatia-ref aa34a4cc; same workflow_call inputs and secrets) The lock is the chain's output for this exact tree, generated in CI (sha256 58d32e2d...). It was not edited by hand. Measured in that run: close-lock reports 0 dangling refs, check-lock-sync.sh passes, check-actions-lock-gate.sh passes at 75bd5994 and at 3c00687a, and the Hypatia scan at aa34a4cc finds 0 invalid_actions_lock (2 before). Raw `gh actions-lock --verify` (v0.2.0) still flags the job-level reusable records as unused, on main's lock too. It cannot see job-level `uses:`. The estate verifier (update-actions-lock.sh --verify-local) accepts that coverage and passes. The one-off lock-regen workflow left behind by #441 is deleted. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015jzCHZx4Rt65NDaGLDrjLp --- .github/workflows/actions.lock | 72 ++++++++--- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/security-scan.yml | 2 +- .github/workflows/spark-theatre-gate.yml | 2 +- .github/workflows/zz-one-off-lock-regen.yml | 128 -------------------- 9 files changed, 62 insertions(+), 152 deletions(-) delete mode 100644 .github/workflows/zz-one-off-lock-regen.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 404b96f4..7754a808 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -46,9 +46,9 @@ workflows: - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/idris2-abi-ci.yml': - 'actions/checkout@v7.0.1' '.github/workflows/label-triage.yml': [] @@ -58,7 +58,7 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/mvp-smoke.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -81,17 +81,17 @@ workflows: - 'swatinem/rust-cache@v2.9.2' - 'taiki-e/install-action@v2.87.28' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/security-scan.yml': - - 'hyperpolymath/panic-attack@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea' + - 'hyperpolymath/panic-attack@8955f615f769204e42340e08bdea2de9d72e81cd' '.github/workflows/server-boot-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/spark-theatre-gate.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.2' @@ -106,6 +106,11 @@ workflows: - 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f' - 'mlugg/setup-zig@v2.2.1' dependencies: + 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 'actions/attest-build-provenance@v4.2.2': ref: 'v4.2.2' commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8' @@ -148,6 +153,11 @@ dependencies: commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' owner_id: 44036562 repo_id: 192626254 + 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08': + ref: 'v4.6.0' + commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' @@ -175,9 +185,9 @@ dependencies: commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' owner_id: 42048915 repo_id: 356423100 - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8': ref: 'v1' - commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 'dtolnay/rust-toolchain@v1': @@ -225,9 +235,18 @@ dependencies: commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f' owner_id: 6759885 repo_id: 1326697643 - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': - ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' - commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + 'hyperpolymath/panic-attack@8955f615f769204e42340e08bdea2de9d72e81cd': + ref: '8955f615f769204e42340e08bdea2de9d72e81cd' + commit: 'sha1-8955f615f769204e42340e08bdea2de9d72e81cd' + owner_id: 6759885 + repo_id: 1152434997 + uses: + - 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' + 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0': + ref: '3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + commit: 'sha1-3c00687a5bbd0d881d351db8502417b5d0a8b0b0' owner_id: 6759885 repo_id: 1116521501 uses: @@ -235,11 +254,11 @@ dependencies: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'mlugg/setup-zig@v2.2.1': @@ -247,9 +266,9 @@ dependencies: commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' owner_id: 7289241 repo_id: 812112570 - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: 'v2.4.4' - commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e': + ref: 'v2.5.0' + commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e' owner_id: 67707773 repo_id: 421101922 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': @@ -262,6 +281,25 @@ dependencies: commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' owner_id: 108928776 repo_id: 512644635 + 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a': + ref: 'f7dd8c54c2067bafc12ca7a55595d5ee9b75204a' + commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a' + owner_id: 80431187 + repo_id: 475074978 + uses: + - 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08' + - 'slsa-framework/slsa-github-generator@v2.1.0' + - 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda' + 'slsa-framework/slsa-github-generator@v2.1.0': + ref: 'v2.1.0' + commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a' + owner_id: 80431187 + repo_id: 475074978 + 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda': + ref: 'v2.2.1' + commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda' + owner_id: 2242 + repo_id: 204253808 'swatinem/rust-cache@v2.9.2': ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index e02ca45f..a8d0dc85 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index cc0b7276..76f80191 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,6 +21,6 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 16b1ac1d..a623e1ba 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -24,7 +24,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 73f52da2..14b23c3a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,4 +26,4 @@ jobs: security-events: write id-token: write contents: read - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c81b6352..fd1c6e17 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,4 +23,4 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index bfa885fa..f56d2668 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -24,6 +24,6 @@ permissions: jobs: scan: - uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea # main 2026-10-01 panic-attack#209: SHA-pinned steps (skip dispatch without VERISIMDB_PAT) + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@8955f615f769204e42340e08bdea2de9d72e81cd # main 2026-10-20: dtolnay/rust-toolchain v1 at 683b588 (the b689a74 pin was a commit no tag names any more) secrets: VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }} diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index d36bbd52..ca2b37c9 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -20,7 +20,7 @@ permissions: jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml deleted file mode 100644 index 5a0e311f..00000000 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ /dev/null @@ -1,128 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, removed again before the PR leaves draft. Regenerates echidna's own -# actions.lock with the estate repair order (regen_lock in -# standards/scripts/regen-dependabot-locks.sh: gh actions-lock, relock-sha-keys, -# complete-job-refs, close-lock, prune-stale), on a tree where this file is -# already deleted, then checks the result with close-lock (dangling count), -# `gh actions-lock --verify`, check-lock-sync, the governance gate, and a -# Hypatia scan at aa34a4cc. Three variants of the caller pins are measured: -# v0 pins as on main -# v1 panic-attack scan-and-report.yml -> panic-attack main (8955f615) -# v2 v1 + every hyperpolymath/standards reusable -> 3c00687a (standards#1315) -# It has no `uses:` steps, so it needs no lock entry to start. It writes -# nothing back: the lock is printed and reaches the repository in a reviewed -# commit. -name: one-off actions.lock regeneration -on: - push: - branches: [claude/stoic-brown-26h7xi] -permissions: - contents: read -jobs: - regen: - runs-on: ubuntu-24.04 - timeout-minutes: 40 - strategy: - fail-fast: false - matrix: - variant: [v0, v1, v2] - env: - GH_TOKEN: ${{ github.token }} - VARIANT: ${{ matrix.variant }} - BRANCH: claude/stoic-brown-26h7xi - STANDARDS_SHA: 3c00687a5bbd0d881d351db8502417b5d0a8b0b0 - STANDARDS_OLD_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 - PANIC_OLD_SHA: b689a74d2762a1c19839ae3fbd59b7fe5ef920ea - PANIC_NEW_SHA: 8955f615f769204e42340e08bdea2de9d72e81cd - HYPATIA_SHA: aa34a4cc6ba39d873710ff39763fdb9cde715f9d - steps: - - name: Regenerate actions.lock and verify it - run: | - set +e -uo pipefail - cd "$RUNNER_TEMP" - git clone --quiet --branch "$BRANCH" https://github.com/hyperpolymath/echidna.git ec - git -C ec log --oneline -1 - cp ec/.github/workflows/actions.lock lock.main - # The tree the PR lands: this one-off file deleted, pins per variant. - git -C ec rm --quiet .github/workflows/zz-one-off-lock-regen.yml - if [ "$VARIANT" != v0 ]; then - sed -i "s/$PANIC_OLD_SHA/$PANIC_NEW_SHA/" ec/.github/workflows/security-scan.yml - fi - if [ "$VARIANT" = v2 ]; then - grep -l "hyperpolymath/standards/.github/workflows/.*@$STANDARDS_OLD_SHA" ec/.github/workflows/*.yml \ - | xargs sed -i "s#\(hyperpolymath/standards/.github/workflows/[^@]*\)@$STANDARDS_OLD_SHA#\1@$STANDARDS_SHA#" - fi - git -C ec add -A - git -C ec diff --cached --stat - git -C ec diff --cached -- . ':(exclude).github/workflows/zz-one-off-lock-regen.yml' - git -C ec -c user.name=regen -c user.email=regen@localhost commit --quiet -m "variant $VARIANT" - git clone --quiet https://github.com/hyperpolymath/standards.git std - git -C std worktree add --quiet --detach ../std-new "$STANDARDS_SHA" - git -C std worktree add --quiet --detach ../std-old "$STANDARDS_OLD_SHA" - sudo apt-get install -y -qq gawk >/dev/null - gh extension install github/gh-actions-lock --pin v0.2.0 - gh actions-lock --version - export GH_BIN=gh REGEN_TOOLS="$PWD/std-new/scripts" - source std-new/scripts/regen-dependabot-locks.sh - set +e - outcome="$(regen_lock "$PWD/ec")" - echo "OUTCOME[$VARIANT]=$outcome" - git -C ec status --porcelain - echo "== close-lock re-run (expect dangling refs: 0, exit 0)" - (cd ec && GH_BIN=gh bash ../std-new/scripts/close-lock.sh; echo "CLOSE_RC[$VARIANT]=$?") - git -C ec diff --quiet -- .github/workflows/actions.lock && echo "lock unchanged vs variant commit" || echo "lock differs from the variant commit (expected: regenerated)" - echo "== independent dangling-edge count" - L=ec/.github/workflows/actions.lock - awk '/^dependencies:/{f=1;next} f&&match($0,/^ '\''[^'\'']+'\'':$/){k=$0;sub(/^ '\''/,"",k);sub(/'\'':$/,"",k);print k}' "$L" | LC_ALL=C sort -u > keys.txt - { awk '/^workflows:/{f=1;next} f&&/^[a-z_]+:/{f=0} f&&match($0,/^ - '\''[^'\'']+'\''/){k=$0;sub(/^ - '\''/,"",k);sub(/'\''.*$/,"",k);print k}' "$L" - awk '/^dependencies:/{f=1} f&&match($0,/^ - '\''[^'\'']+'\''/){k=$0;sub(/^ - '\''/,"",k);sub(/'\''.*$/,"",k);print k}' "$L"; } | LC_ALL=C sort -u > edges.txt - echo "DANGLING[$VARIANT]=$(LC_ALL=C comm -23 edges.txt keys.txt | grep -c .)" - LC_ALL=C comm -23 edges.txt keys.txt - echo "== gh actions-lock --verify" - (cd ec && gh actions-lock --verify; echo "VERIFY_RC[$VARIANT]=$?") - git -C ec status --porcelain - git -C ec checkout --quiet -- . ':(exclude).github/workflows/actions.lock' - echo "== update-actions-lock.sh --verify-local" - (cd ec && GH_BIN=gh bash ../std-new/scripts/update-actions-lock.sh --verify-local; echo "VERIFY_LOCAL_RC[$VARIANT]=$?") - echo "== check-lock-sync.sh" - (cd ec && bash ../std-new/scripts/check-lock-sync.sh .github/workflows; echo "SYNC_RC[$VARIANT]=$?") - for g in std-old std-new; do - echo "== governance lock gate at $g" - (cd ec && ACTIONS_LOCK_VERIFIER="$PWD/../$g/scripts/update-actions-lock.sh" \ - bash "../$g/scripts/check-actions-lock-gate.sh" .github/workflows; echo "GATE_RC[$VARIANT/$g]=$?") - done - git -C ec checkout --quiet -- . ':(exclude).github/workflows/actions.lock' - git -C ec status --porcelain - echo "== diff against main's lock" - diff -u lock.main "$L" - echo "LOCK-SHA256[$VARIANT] $(sha256sum < "$L" | cut -d' ' -f1)" - echo "LOCK-B64[$VARIANT] $(base64 -w0 < "$L")" - cp "$L" lock.regen - exit 0 - - - name: Hypatia scan at aa34a4cc, main's lock and the regenerated one - if: always() - run: | - set -euo pipefail - cd "$RUNNER_TEMP" - # Elixir 1.19.4 / OTP 28.3 from builds.hex.pm (what erlef/setup-beam - # installs), so this job needs no `uses:` step. - mkdir -p otp elixir - curl -fsSL https://builds.hex.pm/builds/otp/ubuntu-24.04/OTP-28.3.tar.gz | tar xz -C otp --strip-components=1 - (cd otp && ./Install -minimal "$PWD" >/dev/null) - curl -fsSL -o elixir.zip https://builds.hex.pm/builds/elixir/v1.19.4-otp-28.zip - unzip -q elixir.zip -d elixir - export PATH="$PWD/otp/bin:$PWD/elixir/bin:$PATH" - elixir --version - mix local.hex --force >/dev/null && mix local.rebar --force >/dev/null - git init -q hy && git -C hy remote add origin https://github.com/hyperpolymath/hypatia.git - git -C hy fetch -q --depth 1 origin "$HYPATIA_SHA" && git -C hy checkout -q --detach FETCH_HEAD - git -C hy rev-parse HEAD - (cd hy && mix deps.get >/dev/null && mix escript.build >/dev/null) - for which in main regen; do - cp "lock.$which" ec/.github/workflows/actions.lock - (cd ec && HYPATIA_FORMAT=json "$RUNNER_TEMP/hy/hypatia-cli.sh" scan . > "$RUNNER_TEMP/findings.$which.json" || true) - jq -e 'type == "array"' "findings.$which.json" >/dev/null || { echo "scan $which did not produce a JSON array"; head -c 2000 "findings.$which.json"; exit 1; } - echo "== $VARIANT/$which lock: $(jq length "findings.$which.json") findings; invalid_actions_lock entries: $(jq '[.[] | select(tostring | test("invalid_actions_lock"))] | length' "findings.$which.json")" - jq -c '.[] | select(tostring | test("invalid_actions_lock|workflow_dependencies_missing"))' "findings.$which.json" | cut -c1-1500 - done